* Re: [PATCH 7.2 0862/1815] wifi: mt76: mt7921: validate CLC firmware records
[not found] <20260912065709.160404014@linuxfoundation.org>
@ 2026-09-12 14:43 ` Junjie Cao
2026-09-12 21:00 ` Sasha Levin
0 siblings, 1 reply; 2+ messages in thread
From: Junjie Cao @ 2026-09-12 14:43 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, Sasha Levin, Laxman Acharya Padhya,
Felix Fietkau, Mikhail Gavrilov, linux-wireless
On Sat, 12 Sep 2026 08:43:32 +0200, Greg Kroah-Hartman wrote:
> 7.2-stable review patch. If anyone has any objections, please let me know.
[...]
> [ Upstream commit 9417c5818a0146980c2608fda94c908e604eb033 ]
Please drop this from 7.2, 6.18, 6.12, 6.6 and 6.1 for now.
On its own it breaks probe on MT7922 with linux-firmware 20260810:
the CLC blob in WIFI_RAM_CODE_MT7922_1.bin carries a record with idx
3, these trees size phy->clc[] at 3 or 2, and the new bounds check
fails mt7921_run_firmware() with -EINVAL. Mainline is fine because
e9f3f1cc133f, also in v7.3-rc1, grew the array to 4. Mikhail Gavrilov
hit it with this commit on a v7.2 tree:
https://lore.kernel.org/all/20260816132325.23007-1-mikhail.v.gavrilov@gmail.com/
The check is still wanted here, today that record is indexed past the
array (UBSAN, https://bugzilla.redhat.com/show_bug.cgi?id=2515420),
but only with the follow-up that skips unknown records. That is on
linux-wireless with Tested-by and Reviewed-by, not applied yet:
https://lore.kernel.org/linux-wireless/20260816174841.1918-1-acharyalaxman8848@gmail.com/
Once it lands the two can go together.
^ permalink raw reply [flat|nested] 2+ messages in thread